You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/data-factory/connector-oracle.md
+32-29Lines changed: 32 additions & 29 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ ms.service: data-factory
7
7
ms.subservice: data-movement
8
8
ms.custom: synapse
9
9
ms.topic: conceptual
10
-
ms.date: 05/15/2024
10
+
ms.date: 05/27/2024
11
11
ms.author: jianleishen
12
12
---
13
13
@@ -109,43 +109,46 @@ To enable encryption on Oracle connection, you have two options:
109
109
110
110
- To use **Triple-DES Encryption (3DES) and Advanced Encryption Standard (AES)**, on the Oracle server side, go to Oracle Advanced Security (OAS) and configure the encryption settings. For details, see this [Oracle documentation](https://docs.oracle.com/cd/E11882_01/network.112/e40393/asointro.htm#i1008759). The Oracle Application Development Framework (ADF) connector automatically negotiates the encryption method to use the one you configure in OAS when establishing a connection to Oracle.
111
111
112
-
- To use **TLS**:
112
+
- To use **TLS**, set up `truststore` for SSL server authentication by applying one of the following three methods:
113
113
114
-
1. Get the TLS/SSL certificate info. Get the Distinguished Encoding Rules (DER)-encoded certificate information of your TLS/SSL cert, and save the output (----- Begin Certificate … End Certificate -----) as a text file.
114
+
- **Method 1 (recommended)**:
115
115
116
-
```
117
-
openssl x509 -inform DER -in [Full Path to the DER Certificate including the name of the DER Certificate] -text
118
-
```
116
+
1. Install the TLS/SSL certificate by importing it into the local certificate store. The built-in Oracle driver is able to load the needed certificate from the certificate store.
119
117
120
-
**Example:** Extract cert info from DERcert.cer, and then save the output to cert.txt.
118
+
2. In the service, configure the Oracle connection string with `EncryptionMethod=1`.
121
119
122
-
```
123
-
openssl x509 -inform DER -in DERcert.cer -text
124
-
Output:
125
-
-----BEGIN CERTIFICATE-----
126
-
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
127
-
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
128
-
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
129
-
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
130
-
XXXXXXXXX
131
-
-----END CERTIFICATE-----
132
-
```
133
-
134
-
2. Build the `keystore` or `truststore`. The following command creates the `truststore` file, with or without a password, in PKCS-12 format.
120
+
- **Method 2**:
135
121
136
-
```
137
-
openssl pkcs12 -in [Path to the file created in the previous step] -out [Path and name of TrustStore] -passout pass:[Keystore PWD] -nokeys -export
138
-
```
122
+
1. Get the TLS/SSL certificate information. Get the Distinguished Encoding Rules (DER)-encoded or Privacy Enhanced Mail (PEM)-encoded certificate information of your TLS/SSL cert, and save the output (----- Begin Certificate … End Certificate -----) as a text file.
139
123
140
-
**Example:** Create a PKCS12 `truststore` file, named MyTrustStoreFile, with a password.
124
+
```
125
+
openssl x509 -inform (DER|PEM) -in [Full Path to the DER/PEM Certificate including the name of the DER/PEM Certificate] -text
2. In the service, configure the Oracle connection string with `EncryptionMethod=1` and the corresponding `TrustStore` value. For example, `Host=<host>;Port=<port>;Sid=<sid>;User Id=<username>;Password=<password>;EncryptionMethod=1;TrustStore= data:// -----BEGIN CERTIFICATE-----<certificate content>-----END CERTIFICATE-----`
145
129
146
-
3. Place the `truststore` file on the self-hosted IR machine. For example, place the file at C:\MyTrustStoreFile.
147
-
4. In the service, configure the Oracle connection string with `EncryptionMethod=1` and the corresponding `TrustStore`/`TrustStorePassword`value. For example, `Host=<host>;Port=<port>;Sid=<sid>;User Id=<username>;Password=<password>;EncryptionMethod=1;TrustStore=C:\\MyTrustStoreFile;TrustStorePassword=<trust_store_password>`.
130
+
>[!Note]
131
+
>- The value of trust store field should be prefixed with `data://`.
132
+
>- When specifying content for multiple certificates, specify the content of each certificate between `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`. The number of dashes (`-----`) should be the same before and after both `BEGIN CERTIFICATE` and `END CERTIFICATE`. For example:<br>
> - The `TrustStore` field supports content up to 8192 characters in length.
148
139
140
+
-**Method 3**:
141
+
142
+
1. Create the `truststore` file with strong ciphers like AES256.
143
+
144
+
```
145
+
openssl pkcs12 -in [Full Path to the DER/PEM Certificate including the name of the DER/PEM Certificate] -out [Path and name of TrustStore] -passout pass:[Keystore PWD] -keypbe AES-256-CBC -certpbe AES-256-CBC -nokeys -export
146
+
```
147
+
2. Place the `truststore` file on the self-hosted integration runtime machine. For example, place the file at `C:\MyTrustStoreFile`.
148
+
149
+
3. In the service, configure the Oracle connection string with `EncryptionMethod=1` and the corresponding `TrustStore`/`TrustStorePassword` value. For example, `Host=<host>;Port=<port>;Sid=<sid>;User Id=<username>;Password=<password>;EncryptionMethod=1;TrustStore=C:\\MyTrustStoreFile;TrustStorePassword=<trust_store_password>`.
**Cause**: The `truststore` is not appropriate for OpenSSL 3.0, as the `truststore` file is generated using weak ciphers like RC4, MD5 and SHA1.
59
+
60
+
**Recommendation**: You need to re-create the `truststore` using the strong ciphers like AES256. Refer to this [section](connector-oracle.md#linked-service-properties) for details about setting up TLS connection using `truststore`.
61
+
54
62
## Related content
55
63
56
64
For more troubleshooting help, try these resources:
0 commit comments